- OpenStack-announce - lists.openstack.org

[OSSA 2014-041.1] Glance v2 API unrestricted path traversal (CVE-2014-9493) ERRATA 1
by Grant Murphy 06 Jan '15

06 Jan '15

OpenStack Security Advisory: 2014-041 (ERRATA 1) CVE: CVE-2014-9493 Date: January 5, 2015 Title: Glance v2 API unrestricted path traversal Reporter: Masahito Muroi (NTT) Products: Glance Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Errata: When the original advisory was published a CVE number was not assigned. CVE-2014-9493 can now be used to track this vulnerability. Kilo (development branch) fix: https://review.openstack.org/141706 Juno fix: https://review.openstack.org/142373 Icehouse fix: https://review.openstack.org/142788 Notes: * This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. * The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9493 https://launchpad.net/bugs/1400966 OSSA History: 2015-01-05 - Errata 1 2014-12-23 - Original Version -- Grant Murphy OpenStack Vulnerability Management Team

1 0

OpenStack Community Weekly Newsletter (Dec 20 - 26)
by Stefano Maffulli 27 Dec '14

27 Dec '14

Last newsletter of 2014, see you again in 2015! University of Hawaii College of Education harnesses OpenStack to support faculty research via a secure private cloud OpenStack powers a Holodeck at University of Hawaii at Manoa... Read the full story on Mirantis blog. The TOSCA Cloud State of the Union A nice summary of the status of OpenStack Heat and the relation between the different specifications to describe topology and orchestration in cloud world. Relevant Conversations * Application level HA via Heat * The state of nova-network to neutron migration * [Openstack-operators] Packaging sample config versions Deadlines and Development Priorities * [nova] Kilo Project Priorities * Neutron Priorities for Kilo * [Nova] Mid-cycle meetup details for kilo Security Advisories and Notices * [OSSA-2014-041] Glance v2 API unrestricted path traversal Reports from Previous Events * Rhones-Alpes meetup summary Tips ‘n Tricks * By Lars Kellogg-Stedman: Accessing the serial console of your Nova servers * By Darryl Cauldwell:Create A vSphere OpenStack Glance Windows VM Image Upcoming Events 2015 OpenStack Foundation Events Plan and Calls for Papers Available. The 2015 events plan is now available on the Global Events Calendar wiki. The detailed spreadsheet covers industry events, Summits (dates and locations), as well as regional OpenStack Days organized by the community. If you’re interested in sponsoring or speaking at a planned OpenStack Day, please contact the contact listed in the spreadsheet. * [Call for Speaker, Sponsor, Participants] OpenStack Day in Korea - Feb. 05, 2015 * Jan 15, 2015 Deep Dive into Trove Austin, Texas, US * Feb 05, 2015 OpenStack Day in Korea Seoul, Seoul, KR * Feb 19 - 20, 2015 World Techies Forum Mumbai, Maharashtra, IN * Apr 13 - 14, 2015 OpenStack Live Santa Clara, CA, US * Apr 22 - 23, 2015 China SDNNFV Conference Beijing, CN * May 18 - 22, 2015 OpenStack Summit May 2015 Vancouver, BC * Sep 17, 2015 OpenStack Benelux Conference 2015 Bussum, NL Other News * Volunteers needed for OpenStack Stand at FOSDEM in Brussels * Symantec joins OpenStack Foundation as Gold Member! * Keystone Middleware 1.3.1 release * OpenStack Crossproject Meeting: suspended for holidays. Got Answers? Ask OpenStack is the go-to destination for OpenStack users. Interesting questions waiting for answers: * how to extract the image details from glance api * HEAT grub commands for CentOS 7 Nova Instance * swift change replication address * Solaris 11.2 Openstack - CSRF Verification failed * How to retrieve ceilometer statistics for the meter "network.incoming.bytes" for an instance * Nova Scheduler warning "Host has more disk space than database expected" on launching instances * How to configure VirtualBox based testing environment? The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment.

1 0

[OSSA-2014-041] Glance v2 API unrestricted path traversal
by Grant Murphy 24 Dec '14

24 Dec '14

OpenStack Security Advisory: 2014-041 CVE: Requested Date: December 23, 2014 Title: Glance v2 API unrestricted path traversal Reporter: Masahito Muroi (NTT) Products: Glance Versions: up to 2014.1.3 and 2014.2 version up to 2014.2.1 Description: Masahito Muroi from NTT reported a vulnerability in Glance. By setting a malicious image location an authenticated user can download or delete any file on the Glance server for which the Glance process user has access to. Only setups using the Glance V2 API are affected by this flaw. Kilo (development branch) fix: https://review.openstack.org/141706 Juno fix: https://review.openstack.org/142373 Icehouse fix: https://review.openstack.org/142788 Notes: * This fix was included in the kilo-1 development milestone and will be included in future 2014.2.2 (juno) and 2014.1.4 (icehouse) releases. * The OpenStack VMT recommends revoking all credentials stored in files accessible by Glance as a precautionary measure. * A CVE has been requested for this issue, the OpenStack VMT will issue an errata with the correct CVE number assigned once this information is available. References: https://launchpad.net/bugs/1400966 -- Grant Murphy OpenStack Vulnerability Management Team

1 0

[keystonemiddleware] Keystone Middleware 1.3.1 release
by Morgan Fainberg 23 Dec '14

23 Dec '14

The Keystone development community would like to announce the 1.3.1 release of the Keystone Middleware package. This release can be installed from the following locations: * http://tarballs.openstack.org/keystonemiddleware <http://tarballs.openstack.org/keystonemiddleware> * https://pypi.python.org/pypi/keystonemiddleware <https://pypi.python.org/pypi/keystonemiddleware> 1.3.1 ------- * auth_token middleware no longer contacts keystone when a request with no token is received. Detailed changes in this release beyond what is listed above: https://launchpad.net/keystonemiddleware/+milestone/1.3.1

1 0

OpenStack Community Weekly Newsletter (Dec 13 - 20)
by Stefano Maffulli 20 Dec '14

20 Dec '14

1 0

Swift 2.2.1 released
by John Dickinson 20 Dec '14

20 Dec '14

I'm happy to announce the release of Swift 2.2.1. The work of 28 contributors (including 8 first-time contributors), this release is definitely operator-centric. I recommend that you upgrade; as always you can upgrade to this release with no customer downtime. Get the release: https://launchpad.net/swift/kilo/2.2.1 Full change log: https://github.com/openstack/swift/blob/master/CHANGELOG Below I've highlighted a few of the more significant updates in this release. * Swift now rejects object names with unicode surrogates. These unicode code points are not able to be encoded as UTF-8, so they are now formally rejected. * Storage node error limits now survive a ring reload. Each Swift proxy server tracks errors when talking to a storage node. If a storage node sends too many errors, no further requests are sent to that node for a time. However, previously this error tracking was cleared with a ring reload, and a ring reload could happen frequently if some servers were being gradually added to the cluster. Now, the error tracking is not lost on ring reload, and error tracking is aggregated across storage polices. Basically, this means that the proxy server has a more accurate view of the health of the cluster and your cluster will be less stressed when you have failures and capacity adjustments at the same time. * Clean up empty account and container partitions directories if they are empty. This keeps the system healthy and prevents a large number of empty directories from (significantly) slowing down the replication process. * Swift now includes a full translation for Simplified Chinese (zh_CN locale). I'd like to thank all of the Swift contributors for helping with this release. I'd especially like to thank the first-time contributors listed below: Cedric Dos Santos Martin Geisler Filippo Giunchedi Gregory Haynes Daisuke Morita Hisashi Osanai Shilla Saebi Pearl Yajing Tan Thank you, and have a happy holiday season. John

1 0

Kilo-1 development milestone available
by Thierry Carrez 19 Dec '14

19 Dec '14

Hi everyone, The first milestone of the Kilo development cycle, "kilo-1" is now reached for Keystone, Glance, Nova, Horizon, Neutron, Cinder, Ceilometer, Heat, Trove, Sahara, and Ironic ! It contains all the new features and bugfixes that have been added since the Juno Feature Freeze in September. You can find the full list of new features and fixed bugs, as well as tarball downloads, at: https://launchpad.net/keystone/kilo/kilo-1 https://launchpad.net/glance/kilo/kilo-1 https://launchpad.net/nova/kilo/kilo-1 https://launchpad.net/horizon/kilo/kilo-1 https://launchpad.net/neutron/kilo/kilo-1 https://launchpad.net/cinder/kilo/kilo-1 https://launchpad.net/ceilometer/kilo/kilo-1 https://launchpad.net/heat/kilo/kilo-1 https://launchpad.net/trove/kilo/kilo-1 https://launchpad.net/sahara/kilo/kilo-1 https://launchpad.net/ironic/kilo/kilo-1 91 blueprints were implemented and no less than 1056 bugs were fixed during this milestone. And that is not even counting all the features and bugfixes that were pushed to Oslo libraries in the same timeframe. The next development milestone, kilo-2, is scheduled for February 5th. You can further track upcoming features and Kilo release cycle status at: http://status.openstack.org/release/ Enjoy your local end-of-year holidays ! -- Thierry Carrez (ttx)

1 0

[keystonemiddleware] keystonemiddlware release 1.3.0
by Morgan Fainberg 19 Dec '14

19 Dec '14

The Keystone development community would like to announce the 1.3.0 release of the keystone middleware package. This release can be installed from the following locations: * http://tarballs.openstack.org/keystonemiddleware * https://pypi.python.org/pypi/keystonemiddleware 1.3.0 ------- * http_connect_timeout option is now an integer instead of a boolean. * The service user for auth_token middlware can now be in a domain other than the default domain. Detailed changes in this release beyond what is listed above: https://launchpad.net/keystonemiddleware/+milestone/1.3.0

1 0

[python-keystoneclient] Release of python-keystoneclient 1.0.0
by Morgan Fainberg 19 Dec '14

19 Dec '14

The Keystone development community would like to announce the release of python-keystoneclient 1.0.0. The move to the 1.x.x development branch was made to match the perception that the library has long been considered stable. Beyond the move to the stable release version, this release is no different than any other python-keystoneclient release. This release can be installed from the following locations: * http://tarballs.openstack.org/python-keystoneclient <http://tarballs.openstack.org/python-keystoneclient> * https://pypi.python.org/pypi/python-keystoneclient <https://pypi.python.org/pypi/python-keystoneclient> 1.0.0 ------- * Registered CLI Options will no longer use the default values instead of the ENV variables (if present) * The `curl` examples from the debug output now includes `--globoff` for ipv6 urls * HTTPClient will no longer incorrectly raise AttributeError if authentication has not occurred when checking if `.has_service_catalog` Detailed changes in this release beyond what is listed above: https://launchpad.net/python-keystoneclient/+milestone/1.0.0

1 0

OpenStack Community Weekly Newsletter (Dec 6 - 13)
by Stefano Maffulli 13 Dec '14

13 Dec '14

OpenStack DefCore Enters Execution Phase. Help! <http://robhirschfeld.com/2014/12/11/openstack-defcore-havana/> OpenStack DefCore Committee has established the principles and first artifacts required for vendors using the OpenStack trademark <https://wiki.openstack.org/wiki/Governance/DefCoreLexicon>. Over the next release cycle, we will be applying these to the Icehouse and Juno releases. Rob will be doing two sessions about DefCore next week (will be recorded): Tues Dec 16 at 9:45 am PST- OpenStack Podcast #14 with Jeff Dickey <http://goo.gl/pR41zD> and Thurs Dec 18 at 9:00 am PST – Online Meetup about DefCore with Rafael Knuth <http://rafstack.tumblr.com/post/104926788033/online-meetup-defcore-making-o…>. Keeping up to date with OpenStack Blueprints <http://technodrone.blogspot.com/2014/12/keeping-up-to-date-with-openstack.h…> OpenStack <http://www.openstack.org/> is a living product – and because it is community driven - changes are being proposed almost constantly. The specifications approved in each project are published on http://specs.openstack.org <http://specs.openstack.org/> as html pages and RSS feeds. Maish Saidel-Keesing <http://technodrone.blogspot.com/search/label/OpenStack> compiled an OPML file <http://maishsk.com/blog/files/opml.opml> with all the current projects that you can add to your favorite RSS reader. Korea User Group got "The community of the Year" award <http://lists.openstack.org/pipermail/user-committee/2014-December/000334.ht…> Great news for the whole OpenStack community: OpenStack Korea User Group received “The community of the Year” award from Korea Open Source Software Association. Congratulations to all for the amazing work you've been doing all these years. The Korean user group doesn't rest on their laurels and they're busy organizing the OpenStack Day Korea 2015: check the sponsorship opportunities <https://www.dropbox.com/s/cz1i3h2kho40vej/OpenStack%20Day%20Sponsor%20Progr…>. Ask OpenStack passes 10,000 questions <http://www.openstack.org/blog/2014/12/ask-openstack-passes-10000-questions/> Recently, our Q&A site, Ask OpenStack passed an important milestone – more than 10,000 questions. Since it was launched by community manager Stefano Maffulli with the help of our tame AskBot <http://askbot.com/> developer Evgeny Fadeev <https://github.com/evgenyfadeev> early last year, we’ve had great support from our entire community – users and vendor support staff alike getting on there and helping each other out. Everybody can give answers: read how to give answers <https://wiki.openstack.org/wiki/Community/AskModerators> and head out to answer questions on Ask OpenStack <http://www.openstack.org/blog/feed/%20https://ask.openstack.org/en/question…>. Relevant Conversations * Nova Specs for Kilo <http://www.stillhq.com/openstack/kilo/000006.html> and live updates for Nova review day <https://review.openstack.org/#/dashboard/?foreach=project%3A%5Eopenstack%2F…> * Proposal for Neutron core and vendor code decomposition <https://review.openstack.org/134680> [approved and merged] * Looking for ten individuals to participate in a usability study sponsored by the Horizon team <http://lists.openstack.org/pipermail/user-committee/2014-December/000335.ht…> * [neutron] FYI: VPNaaS Sub-team meeting setup... <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052705.html> Deadlines and Development Priorities * Neutron Spec Approval Deadline (SAD) <https://wiki.openstack.org/wiki/NeutronKiloProjectPlan>: Monday 12-15-2014. Spec reviews dashboard <https://review.openstack.org/#/dashboard/?foreach=project%3A%5Eopenstack%2F…> o If you have specs pending, stay very vigilant and react fast to comments from reviewers. * [neutron] Services are now split out and neutron is open for commits! <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052713.html> * [nova] Kilo Project Priorities <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052225.html> * Neutron Priorities for Kilo <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052230.html> * [Nova] Mid-cycle meetup details for kilo <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052164.html> Security Advisories and Notices * Horizon denial of service attack through login page (CVE-2014-8124) <http://lists.openstack.org/pipermail/openstack-announce/2014-December/00030…> * Neutron DoS through invalid DNS configuration (CVE-2014-7821) ERRATA 1 <http://lists.openstack.org/pipermail/openstack-announce/2014-December/00030…> Tips ‘n Tricks * By Michelle Yakura <https://www.mirantis.com/blog/tips-on-overcoming-skeptics-and-other-obstacl…>: Tips on Overcoming Skeptics and Other Obstacles to Production OpenStack Clouds <https://www.mirantis.com/blog/tips-on-overcoming-skeptics-and-other-obstacl…> * By Sébastien Han <https://sebastien-han.fr/>: DevStack and remote Ceph cluster <https://sebastien-han.fr/blog/2014/12/11/devstack-and-remote-ceph-cluster/> * By Lars Kellogg-Stedman <http://blog.oddbit.com/>: Cloud-init and the case of the changing hostname <http://blog.oddbit.com/2014/12/10/cloudinit-and-the-case-of-the-changing-ho…> * By Steve Dake <http://sdake.io/>: Isn’t it Atomic on OpenStack Ironic, don’t you think? <http://sdake.io/2014/12/09/isnt-it-atomic-on-openstack-ironic-dont-you-thin…> * By Sébastien Han <https://sebastien-han.fr/>: OpenStack: import existing Ceph volumes in Cinder <https://sebastien-han.fr/blog/2014/12/09/openstack-import-existing-ceph-vol…> * By Craige McWhirter <http://mcwhirter.com.au//tags/OpenStack/>: Managing KVM Console Logs for Nova <http://mcwhirter.com.au//craige/blog/2014/Managing_KVM_Console_Logs_for_Nov…> * By Ryan Hefner: Using Packstack to install Cinder with NetApp Storage Backends <http://netapp.github.io/openstack/2014/12/06/packstack-cinder/> Reports from Previous Events * MySQL and OpenStack Deep Dive Webinar <https://www.youtube.com/watch?v=I3Be-UtDDkg> Upcoming Events * Dec 17, 2014 <http://fit.edu.pk/tutorials> Building Cloud with OpenStack <http://fit.edu.pk/tutorials> Islamabad, PK <http://fit.edu.pk/tutorials> * Dec 18, 2014 <http://meetu.ps/2DTr9p> Is OpenStack ready for Enterprises? <http://meetu.ps/2DTr9p> New York, New York, US <http://meetu.ps/2DTr9p> * Jan 15, 2015 <http://ow.ly/EKWpY> Deep Dive into Trove <http://ow.ly/EKWpY> Austin, Texas, US <http://ow.ly/EKWpY> * Feb 19 - 20, 2015 <http://www.tech-ies.com/> World Techies Forum <http://www.tech-ies.com/> Mumbai, Maharashtra, IN <http://www.tech-ies.com/> * Apr 13 - 14, 2015 <http://www.percona.com/live/openstack-live-2015/> OpenStack Live <http://www.percona.com/live/openstack-live-2015/> Santa Clara, CA, US <http://www.percona.com/live/openstack-live-2015/> * May 18 - 22, 2015 <https://www.openstack.org/summit/vancouver-2015/> OpenStack Summit May 2015 <https://www.openstack.org/summit/vancouver-2015/> Vancouver, BC <https://www.openstack.org/summit/vancouver-2015/> * Sep 17, 2015 <http://www.openstackbeneluxconference.nl/> OpenStack Benelux Conference 2015 <http://www.openstackbeneluxconference.nl/> Bussum, NL <http://www.openstackbeneluxconference.nl/> Other News * Announcing the openstack ansible deployment repo <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052708.html> * [neutron] mid-cycle update <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052715.html> * [OpenStackClient] OSC Release 1.0.1 <http://lists.openstack.org/pipermail/openstack/2014-December/010723.html> * Fedora 21 Cloud Images Available Today <https://openstack.redhat.com/forum/discussion/995/fedora-21-cloud-images-av…> * Ironic + Crowbar: United in Vision, Complementary in Approach <http://robhirschfeld.com/2014/12/09/openstack-ironic-crowbar/> * The EMC Federation Joins the OpenStack Foundation <http://www.cloudscaling.com/blog/openstack/the-emc-federation-joins-the-ope…> * Jumpgate: SoftLayer’s free library for OpenStack cloud compatibility <http://thoughtsoncloud.com/2014/12/jumpgate-softlayers-free-library-opensta…> * Third-party CI documentation WG forming <http://lists.openstack.org/pipermail/openstack-dev/2014-December/052227.html> * OpenStack Project Meeting: Summary <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-11-25-21.…> and full logs <http://eavesdrop.openstack.org/meetings/project/2014/project.2014-11-25-21.…>. Got Answers? Ask OpenStack <https://ask.openstack.org/> is the go-to destination for OpenStack users. Interesting questions waiting for answers: * Keystone: Users with underscore do not show up in user-list <https://ask.openstack.org/en/question/56166/keystone-users-with-underscore-…> * RDO Icehouse with ceph - libvirt error <https://ask.openstack.org/en/question/56148/rdo-icehouse-with-ceph-libvirt-…> * Error when trying to suspend/resume VM in JavaScript with ajax <https://ask.openstack.org/en/question/56067/error-when-trying-to-suspendres…> * Add new ML2 Driver without needing to release all of neutron <https://ask.openstack.org/en/question/56066/add-new-ml2-driver-without-need…> * External Ip not working Until Neutron server is restarted <https://ask.openstack.org/en/question/56047/external-ip-not-working-until-n…> * Add new server instance to existing load balancer pool in heat stack <https://ask.openstack.org/en/question/56042/add-new-server-instance-to-exis…> * heat stack output-show return null <https://ask.openstack.org/en/question/56035/heat-stack-output-show-return-n…> * How to repair a missing container in Swift <https://ask.openstack.org/en/question/56012/how-to-repair-a-missing-contain…> * LBaaS: lb-vip-create fails on device driver haproxy_ns <https://ask.openstack.org/en/question/55970/lbaas-lb-vip-create-fails-on-de…> Welcome New Reviewers and Developers Chris Gacsal <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Ankur Rishi <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Babu Shanmugam <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Alger Wang <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Abhishek G M <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Tom Pollard <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Bogun Dmitriy <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Dan Ritchie <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Cosmin Poieana <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> wangtianfa <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Roman Dobosz <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Park <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Moshe Levi <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Matt Borland <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Toshiaki Higuchi <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Dexter Fryar <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Chris Gacsal <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> Hironori Shiina <http://activity.openstack.org/data/plugins/zfacts/view.action?viewpropertie…> /The weekly newsletter is a way for the community to learn about all the various activities occurring on a weekly basis. If you would like to add content to a weekly update or have an idea about this newsletter, please leave a comment./

1 0